Description:

This thesis explores the fragmentation of Cyber Threat Intelligence (CTI) reporting, focusing on the inconsistent use of data formats, vocabularies, and platform-specific structures. It examines the potential of frameworks like DocIntel, the NICE Cybersecurity Workforce Framework, and the UK's WARP model to bring consistency to how threat intelligence is produced, shared, and used. By integrating insights from community standards such as STIX, MISP Galaxy, and FIRST.org’s CTI curriculum, the study proposes a harmonized reporting structure. It also considers cultural and organizational barriers, aiming to bridge the gap between CTI and risk management practices through clearer roles, shared lexicons, and integrated tooling.